Function TestSQLAnalyzer_DeleteStatements

cmd/gosqlx/cmd/sql_analyzer_test.go:585–666

TestSQLAnalyzer_DeleteStatements tests analysis of DELETE statements

(t *testing.T)

// TestSQLAnalyzer_DeleteStatements tests analysis of DELETE statements
func TestSQLAnalyzer_DeleteStatements(t *testing.T) {
	tests := []struct {
		name                string
		sql                 string
		expectMissingWhere  bool
		expectSecurityIssue bool
	}{
		{
			name:                "DELETE with WHERE",
			sql:                 "DELETE FROM users WHERE id = 1",
			expectMissingWhere:  false,
			expectSecurityIssue: false,
		},
		{
			name:                "DELETE without WHERE (dangerous)",
			sql:                 "DELETE FROM users",
			expectMissingWhere:  true,
			expectSecurityIssue: true, // Missing WHERE on DELETE is a security issue
		},
		{
			name:                "DELETE with complex condition",
			sql:                 "DELETE FROM logs WHERE created_at < '2020-01-01' AND processed = true",
			expectMissingWhere:  false,
			expectSecurityIssue: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			tkz := tokenizer.GetTokenizer()
			defer tokenizer.PutTokenizer(tkz)

			tokens, err := tkz.Tokenize([]byte(tt.sql))
			if err != nil {
				t.Fatalf("Tokenization failed: %v", err)
			}

			p := parser.NewParser()
			astObj := ast.NewAST()
			defer ast.ReleaseAST(astObj)

			result, err := p.ParseFromModelTokens(tokens)
			if err != nil {
				t.Fatalf("Parsing failed: %v", err)
			}
			astObj.Statements = result.Statements

			analyzer := NewSQLAnalyzer()
			report, err := analyzer.Analyze(astObj)
			if err != nil {
				t.Fatalf("Analysis failed: %v", err)
			}

			// Check for missing WHERE issue
			foundMissingWhere := false
			hasSecurityIssue := false
			for _, issue := range report.Issues {
				if strings.Contains(issue.ID, "MISSING_WHERE") {